ContextCheckInterceptConfiguration check for null attribute

[Cantor, Scott]

On 3/10/21, 8:40 AM, "users on behalf of Rod Widdowson" <users-bounces at shibboleth.net on behalf of rdw at steadingsoftware.com> wrote:

>    I'd let other comment more, but it seems to me that the DynamicAttributePredicate[1] allows you find out if
> attributes are present. 

The Dynamic variant might work, but it's seriously confusing to use so I would stick with NOT and the regular one. Or just (and this is really my advice) reverse the polarity.

Any time you set policy based on the absence of something, you have a DoS vector where an error will cause the policy to activate. Sometimes that's ok, but often it's very bad.

-- Scott